Analysis
-
max time kernel
71s -
max time network
70s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250113-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
14-01-2025 06:03
General
-
Target
JvUpdateXX2.exe
-
Size
202KB
-
MD5
8b7e6d84584506e17e54b74bde94fb39
-
SHA1
6091eb1e58a0ea585abcdc2e1ca7c7939348cdef
-
SHA256
f26c9aff73c041c5a506b8e8ede7bc50fe468d34b0cbf750940bb195eb068b0b
-
SHA512
9bfe8a2d5ea2458dd89589a6031f95554c6d757e068a38127880ca3d3d8628d979bd5de1ec31706c6e3c6ca127741c0666e904bec59b7db2d9ab16e0558d2c16
-
SSDEEP
6144:gLV6Bta6dtJmakIM5rp07I0o3SEoJ7X5wR:gLV6BtpmkYp0do/oJ7Xq
Malware Config
Signatures
-
Nanocore family
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAS Manager = "C:\\Program Files (x86)\\NAS Manager\\nasmgr.exe" JvUpdateXX2.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA JvUpdateXX2.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\NAS Manager\nasmgr.exe JvUpdateXX2.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Panther\UnattendGC\setupact.log UserOOBEBroker.exe File opened for modification C:\Windows\Panther\UnattendGC\setuperr.log UserOOBEBroker.exe File opened for modification C:\Windows\Panther\UnattendGC\diagerr.xml UserOOBEBroker.exe File opened for modification C:\Windows\Panther\UnattendGC\diagwrn.xml UserOOBEBroker.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JvUpdateXX2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FileCoAuth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JvUpdateXX2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JvUpdateXX2.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2826969134-2088669430-2680400721-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3268 JvUpdateXX2.exe 3268 JvUpdateXX2.exe 3268 JvUpdateXX2.exe 3268 JvUpdateXX2.exe 3268 JvUpdateXX2.exe 3268 JvUpdateXX2.exe 3268 JvUpdateXX2.exe 3268 JvUpdateXX2.exe 3268 JvUpdateXX2.exe 3268 JvUpdateXX2.exe 3268 JvUpdateXX2.exe 3268 JvUpdateXX2.exe 3268 JvUpdateXX2.exe 3268 JvUpdateXX2.exe 3268 JvUpdateXX2.exe 2388 taskmgr.exe 2388 taskmgr.exe 3268 JvUpdateXX2.exe 3268 JvUpdateXX2.exe 3268 JvUpdateXX2.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 3268 JvUpdateXX2.exe 3268 JvUpdateXX2.exe 3268 JvUpdateXX2.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3268 JvUpdateXX2.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3268 JvUpdateXX2.exe Token: SeDebugPrivilege 2388 taskmgr.exe Token: SeSystemProfilePrivilege 2388 taskmgr.exe Token: SeCreateGlobalPrivilege 2388 taskmgr.exe -
Suspicious use of FindShellTrayWindow 62 IoCs
pid Process 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe -
Suspicious use of SendNotifyMessage 62 IoCs
pid Process 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JvUpdateXX2.exe"C:\Users\Admin\AppData\Local\Temp\JvUpdateXX2.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3268
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
PID:2860
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
PID:3344
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /61⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2388
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\JvUpdateXX2.exe"C:\Users\Admin\AppData\Local\Temp\JvUpdateXX2.exe"1⤵
- System Location Discovery: System Language Discovery
PID:2060
-
C:\Users\Admin\AppData\Local\Temp\JvUpdateXX2.exe"C:\Users\Admin\AppData\Local\Temp\JvUpdateXX2.exe"1⤵
- System Location Discovery: System Language Discovery
PID:1896